--- title: Time to Address Cyber Social Responsibility in ESG Strategies description: Cyber Social Responsibility is not just the right thing to do, it can benefit your bottom line. Learn more about what it means and how to get started. image: https://blog.cybercoach.com/hubfs/cybercoach-social-impact-bg.png --- [![CyberCoach Full Logo with Bot Icon](https://blog.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg)](https://www.cybercoach.com?hsLang=en) - PRODUCT ## CyberCoach at a glance An industry-changing platform built on peer-reviewed research: phishing, secure coding, and AI skills training, delivered directly in Teams, Slack, or the browser. ### [The Science Behind CyberCoach Why traditional phishing simulations don't work, according to peer-reviewed research from ETH Zurich.](https://www.cybercoach.com/science-behind-cybercoach?hsLang=en) ### [Is Phishing Simulation Legal Under GDPR? 9 steps GDPR requires before you phish your employees — and a new simulation approach that doesn't need any of them.](https://www.cybercoach.com/legal-basis-phishing-simulation?hsLang=en) ### [Pricing Flexible plans, also monthly. ](https://www.cybercoach.com/pricing?hsLang=en) ### [Blog Latest insights into security awareness and what's new with CyberCoach.](https://blog.cybercoach.com) ### [Customer Stories Read more about how CyberCoach has helped organizations across different industries modernize their approach to security and AI training. ](https://www.cybercoach.com/customer-stories?hsLang=en) ### [OT Security Training Targeted training for employees working with OT technology.](https://www.cybercoach.com/ot-security-training?hsLang=en) - [AI TRAINING](https://www.cybercoach.com/ai-security-training?hsLang=en) ## [AI Training The most comprehensive role-based AI security and productivity training — built to help employees use AI effectively and safely, and keep your organization compliant with the EU AI Act.](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [AI Security Training Why choose CyberCoach for your AI security training needs?](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [EU AI Act Training Requirements: What You Actually Have To Do AI literacy training has been mandatory since February 2025.  ](https://www.cybercoach.com/eu-ai-act-training-requirements?hsLang=en) - [FOR DEVELOPERS](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ## [For Developers Go beyond OWASP Top10 and offer hands-on interactive training for technical roles in secure coding and efficient use of AI. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ### [Secure Coding Skills Meet ISO/IEC 27001 or SOC 2 requirements for secure development practices with no-nonsense training for your developers and other technical roles, directly in Microsoft Teams or Slack chat. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [COMPANY](https://www.cybercoach.com/about-us?hsLang=en) ## [About us We're growing into the most diverse training platform company on the planet.](https://www.cybercoach.com/about-us?hsLang=en) ### [About Us Get to know our international team.](https://www.cybercoach.com/about-us?hsLang=en) ### [Contact Us Get in touch.](https://www.cybercoach.com/contact-us?hsLang=en) ### [Careers We are hiring.](https://www.cybercoach.com/careers?hsLang=en) ### [Partner with us Learn more about our partner program.](https://www.cybercoach.com/partnerships?hsLang=en) [FREE TRIAL](https://www.cybercoach.com/free-trial?hsLang=en) [GET A DEMO](https://meetings-eu1.hubspot.com/maria-bique/cybercoach-demo?uuid=88959d26-2ff7-4dd0-8ebd-dd43eb31443e) Cyber Social Responsibility # Time to Address Cyber Social Responsibility in ESG Strategies Cyber Social Responsibility is not just the right thing to do, it can benefit your bottom line. Learn more about what it means and how to get started. [Maria Bique](https://blog.cybercoach.com/author/maria-bique) Mar 9, 2023 [Cyber Social Responsibility](https://blog.cybercoach.com/tag/cyber-social-responsibility) [Digital Literacy](https://blog.cybercoach.com/tag/digital-literacy) [Digital Rights](https://blog.cybercoach.com/tag/digital-rights) ### Share this article [mailto:?subject=Check%20out%20https://blog.cybercoach.com/cyber-social-responsibility-in-esg&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/cyber-social-responsibility-in-esg&utm_medium=social&utm_source=email](mailto:?subject=Check%20out%20https://blog.cybercoach.com/cyber-social-responsibility-in-esg&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/cyber-social-responsibility-in-esg&utm_medium=social&utm_source=email) ### Subscribe ### Subscribe ![How to Get Started with Cyber Social Responsibility](https://blog.cybercoach.com/hubfs/cybercoach-social-impact-bg.png) Digital skills inequality threatens all of our safety and we need responsible companies to take action. Privacy and security have become things an individual needs to afford. They require skills and they require ability to select, and often pay for, safer solutions. You can get cheaper or free services, if you pay for them with your data.  #### Why do we have digital skills inequality? The digital skill divide starts already in childhood. Digital safety skills are now being taught in schools, but not all schools can afford devices for kids to practice with, or technically competent staff to educate them. It gets even worse in adulthood. We adults rely on security and privacy awareness education in the workplace. The quality and availability of training varies widely. The vast majority of companies that provide training focus primarily on phishing training, and not on training "civic" online safety and privacy skills. Quality training is also disproportionately available to privileged office workers at larger companies. Only a few companies provide training to staff without laptops.  There is no legal requirement to do so either. Even with the Securities and Exchange Commission (SEC) set to come out with new rules for [ESG disclosures](https://www.sec.gov/news/press-release/2022-92) and [cybersecurity reporting](https://www.sec.gov/news/press-release/2022-39), no one is talking about this societal problem and how companies could make it part of their sustainability strategies. The focus of the new cybersecurity rules is on improving reporting of cybersecurity incidents, cyber risk governance, and oversight. [The SEC privacy rules](https://www.sec.gov/news/press-release/2023-28) are also under reform, but they are still setting a low bar for compliance with protecting customer information, instead of truly protecting individual digital rights. These rules also have a limited impact, as the goal of the SEC is to protect US investors–not individuals or society. Not only is there a lack of regulatory pressure, the "S" (Society) in ESG is even becoming political in the US. This further discourages companies from taking action.  There are amazing non-profits and government organizations trying to bridge the gap and educate citizens, parents and caregivers. The problem is that these resources can be difficult to find, and require an individual to find motivation to seek them out first. That is where companies come in. #### What action can companies take? Cyber Social Responsibility is about taking an active role in protecting your employees and customers as individuals, as well as their digital rights. Reading the below, you may even realize you are already making an effort in this space. Cyber Social Responsibility is less about doing a lot yourself, and more about leveraging resources that are already out there, partnerships and collaboration. Simply doing the right thing and communicating it goes a long way. **Cyber Social Responsibility towards employees is about..​** |   | **Common Practice ** | **Sustainable Practice** | | --- | --- | --- | | **Employee Data Privacy** | Employer decides what is collected. Employee has little to say about it, if they wish to continue to be employed.  | Collecting minimal data from employees, being transparent about it and making sure your employees feel in control of it. Educating employees on their digital rights. No one should have to read a book to understand exactly what you do with employee personal information. ​ Example: Personal use of work devices. What all can your IT/Security team see? Do your employees know to what extent the activity on their devices is being monitored? | | **Employees as Cyber Coaches** | Security training at workplace focuses on protecting the employers' business and transferring the business risk to employees through training sign-offs. | Making it easy for employees to protect their families and families. Rewarding acting as a Cyber Coach to colleagues and in the community. Example: Employer provides anonymous training and support with personal or family security issues, as well as a password manager for employees' families to use. Employer also encourages employees to help their family take the password manager into use. | | **Psychological Safety** | "Motivating" employees through making them fail phishing simulations. Employees cannot influence new security rules and processes that directly impact their work. | Motivating employees to learn online safety and privacy by making them feeling safe and capable of learning. Making sure everyone can influence over decisions affecting them. Eliminating unnecessary red tape and trusting your employees to make good decisions.​ ​ Example: Security team has dealt with a security incident where a stranger joined an online meeting with a client and started presenting graphic videos (aka "Zoombombing"). Instead of immediately blocking screen sharing for all externals in meetings, the security team talked with the people that regularly held meetings with externals, and came up with a solution where employees can grant screen sharing rights upon verifying the participant. | Cyber Social Responsibility towards customers and society is about.. |   | **Common Practice** | **Sustainable Practice** | | --- | --- | --- | | **Customer Data Privacy** | A vague data privacy notice that barely explains the personal data practices, in fear of needing to update it too often. Controlling what data you share is impossible or very difficult: you need to click and read more.  | Collecting data from individuals only in ways that benefit them and making sure people feel in control of it. Educating also customers on their digital rights. Actively influencing other organizations to be progressive with privacy. Again: No one should have to read a book to understand exactly what you do with personal information.  Example: A productivity app company enables new privacy features as defaults free for all customers, and campaigns in order to make sure customers are not only aware of them, but demand similar from their other service providers. | | **Customers as Cyber Coaches** | Security training is offered only to employees and there are limited resources available for customers even on how to safely use the company's product/service. | Inspiring and rewarding acting as a Cyber Coach in society. Developing ways to help customers also learn digital safety skills and media literacy. Example: A bank implements engaging micro-learning and makes it available to all customers and their children in their app. | | **Building Trust ** | Playing it safe with communication and only doing it when it cannot be avoided anymore. Avoiding potentially politically sensitive topics such as disinformation. | Communicating openly and transparently. Verifying information before publishing it, and fighting disinformation by advocating and enabling fact checking. Maximizing customer trust not just in your organization, business and industry, but in digital society and authorities.  Example: Company suffers a data breach and communicates actively with affected individuals, proactively also offering them advice and even tools to help minimize the impact of the breach on them. Company also shares lessons learned in order for other companies to avoid falling victim. | | **Cyber Responsibility in Vendor Assessments** | Vendor Assessment may or may not include requirements for cybersecurity and data privacy.  | Making cyber social responsibility a part of vendor assessments, and partnering with and buying services from cyber responsible organizations. Example: Asking vendors what are they doing to support employees as parents and caregivers to protect their families online. Choosing not to do business with vendors with unethical data practices, or leadership convictions of cybercrime or privacy violations. | ​Cyber Social Responsibility is undoubtedly the right thing to do. There are also direct bottom line benefits to addressing it in your ESG strategy. We will talk more about those as well as share more practical steps to get started with Cyber Social Responsibility in upcoming posts. #### Is Cyber Social Responsibility already part of your ESG work? We'd love to hear about it and share success stories. We are also happy to chat, share our learnings and help you get started (free, with no strings attached).  [Book a Call](https://meetings-eu1.hubspot.com/maria-bique/cyber-social-responsibility-chat) ## Similar posts Training ### [The Pedagogy Behind an Effective Security Awareness Training Program](https://blog.cybercoach.com/dialogic-learning?hsLang=en) CyberCoach is based on dialogic learning and storification in order to maximize learning retention. Learn more about the pedagogy behind CyberCoach. Ian Fox Jul 31, 2024 Cyber Social Responsibility ### [There is some good in this world, and it's worth fighting for](https://blog.cybercoach.com/there-is-some-good-in-this-world-and-its-worth-fighting-for?hsLang=en) There is some good in this world, and it's worth fighting for. Our CEO, Maria Bique, was selected as the role model of the month April by Women4Cyber... Dana Paredes Apr 15, 2024 Cybersecurity ### [How to Choose a Secure Development Training Platform: A Complete Guide](https://blog.cybercoach.com/how-to-choose-a-secure-development-training-a-complete-guide?hsLang=en) Learn how to choose the best Secure Development Training to build secure code, meet compliance, and support devs of all skill levels. Unai Eguiguren Jun 5, 2025 ### Get notified of what's going on in AI and security awareness and compliance **Expert Tips:** Stay informed with curated content, expert opinions, and case studies that are relevant to your organization's security awareness strategy. **Special Offers:** Access to CyberCoach promotions and campaigns.  **Stay Informed:** Get the latest insights and updates on security and AI compliance trends, threats, and best practices delivered directly to your inbox. ![cybercoach_logo_white.svg.2023_03_15_16_58_04.0](https://blog.cybercoach.com/hubfs/cybercoach_logo_white.svg.2023_03_15_16_58_04.0.svg) ### Product - [For Developers](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [AI Security](https://www.cybercoach.com/ai-security-training?hsLang=en) - [Manage Subscription](https://billing.stripe.com/p/login/28o4jRclF4gab1C6oo) - [FAQ](https://www.cybercoach.com/faq?hsLang=en) ### Connect - [Partner Program](https://www.cybercoach.com/partnerships?hsLang=en) - [Careers](https://www.cybercoach.com/careers?hsLang=en) - [For Media](https://www.cybercoach.com/media?hsLang=en) - [Contact Us](https://www.cybercoach.com/contact-us?hsLang=en) ### Legal - [Privacy](https://www.cybercoach.com/cybercoach-website-privacy?hsLang=en) - [General Terms](https://www.cybercoach.com/general-terms?hsLang=en) ### Company - [About Us](https://www.cybercoach.com/about-us?hsLang=en) - [Blog](https://blog.cybercoach.com) - [ESG Policy](https://www.cybercoach.com/esg-policy?hsLang=en) © 2026 CyberCoach All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Maria Bique", "url" : "https://blog.cybercoach.com/author/maria-bique" }, "dateModified" : "2024-10-04T19:17:18.361Z", "datePublished" : "2023-03-09T14:11:12.000Z", "headline" : "Time to Address Cyber Social Responsibility in ESG Strategies", "image" : [ "https://blog.cybercoach.com/hubfs/cybercoach-social-impact-bg.png" ], "mainEntityOfPage" : { "@id" : "https://blog.cybercoach.com/cyber-social-responsibility-in-esg", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.cybercoach.com/hubfs/cybercoach_marketplace_icon.svg" }, "name" : "CyberCoach" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#organization", "@type" : "Organization", "foundingDate" : "2019", "legalName" : "Cult Security", "logo" : "https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg", "name" : "CyberCoach", "sameAs" : [ "https://www.linkedin.com/company/cult-security", "https://x.com/cybercoachUS", "https://www.instagram.com/cybercoachus/", "https://www.youtube.com/@CyberCoachOfficial" ], "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#software", "@type" : "SoftwareApplication", "applicationCategory" : "BusinessApplication", "applicationSubCategory" : "Security awareness and AI skills training", "availableLanguage" : [ "English", "Spanish", "Portuguese (Brazil)", "Portuguese (Portugal)", "French", "Dutch", "German", "Swedish", "Finnish" ], "description" : "CyberCoach is a role-based security awareness, privacy and AI skills training platform that runs as a conversational app inside Microsoft Teams, Slack or a web browser. Employees practice AI skills and responding to social engineering in short, psychologically safe scenario-based sessions. Learning is anonymous while successful completions are recorded per user so the organization can evidence training completion for compliance. CyberCoach can also run on pseudonymous identifiers such as Slack or Microsoft UUIDs, with no personal data shared with CyberCoach.", "featureList" : [ "Conversational phishing and social engineering challenges", "Role-based training programs for technical and non-technical roles", "AI security and AI use training", "Secure coding training for developers", "OT security training", "Custom content creation", "Compliance assessments (ISO/IEC 27001, GDPR, AI compliance)", "Anonymous learning with per-user completion records for compliance", "Optional pseudonymous deployment using Slack or Microsoft UUIDs" ], "name" : "CyberCoach", "offers" : [ { "@type" : "Offer", "description" : "Cover the basics.", "name" : "Starter", "price" : "49", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Broad topic coverage, custom content, hosted kick-off.", "name" : "Advanced", "price" : "159", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Full coverage, 24/7 AI chat, compliance assessments, hosted kick-off.", "name" : "Complete", "price" : "179", "priceCurrency" : "EUR" } ], "operatingSystem" : "Microsoft Teams, Slack, Web browser, iOS, Android", "publisher" : { "@id" : "https://www.cybercoach.com/#organization" }, "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is a security awareness, privacy and AI skills training platform that runs inside Microsoft Teams, Slack or a web browser. Employees practice role-based skills such as responding to social engineering, ethical and productive use of AI and even secure coding skills in short conversational scenarios. Learning is anonymous, while successful completions are stored so the organization can evidence training completion for compliance frameworks such as ISO/IEC 27001 and SOC 2." }, "name" : "What is CyberCoach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, but not by sending deceptive emails to employees. CyberCoach uses conversational phishing challenges in which employees practice recognizing and responding to social engineering scenarios in Teams, Slack or the browser. Peer-reviewed research, including Lain et al. (ETH Zurich, 2022 and 2024), finds that traditional email-based simulated phishing does not reduce risk and can increase misplaced trust in the inbox." }, "name" : "Does CyberCoach do phishing tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Learning is anonymous: how an employee answered a training scenario is never visible to managers or administrators. What is recorded is successful completion, so the organization can evidence who has completed required training for compliance purposes. This is privacy by design: the sensitive part of the interaction stays private, and only the completion fact is retained." }, "name" : "Are individual employee answers visible to managers?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. CyberCoach can be deployed using pseudonymous identifiers, such as Slack or Microsoft UUIDs, so no personal data is shared with CyberCoach. Compliance reporting still works: the mapping between a UUID and a real person is resolved only for authenticated and authorized administrators within the customer's own organization." }, "name" : "Can CyberCoach be used without sharing personal data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach supports security awareness and secure development training requirements under ISO/IEC 27001 and SOC 2, and includes assessments covering ISO 27001, GDPR and AI compliance on the Complete plan." }, "name" : "Which compliance requirements does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is available in English, Spanish, Portuguese (Brazil), Portuguese (Portugal), Polish, French, Dutch, German, Swedish, Norwegian, Danish and Finnish, with more languages in development." }, "name" : "Which languages does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Plans start at 49 EUR per month for Starter, 159 EUR per month for Advanced and 179 EUR per month for Complete, available monthly or yearly, including through the Microsoft Azure Marketplace." }, "name" : "How much does CyberCoach cost?" } ] } ```